Skip to content

Latest commit

 

History

History
100 lines (71 loc) · 3.91 KB

README.md

File metadata and controls

100 lines (71 loc) · 3.91 KB
Raw

AWS Certificate Manager (ACM) Terraform module

Terraform module which creates ACM certificates and validates them using Route53 DNS (recommended) or e-mail.

Terraform versions

Terraform 0.12. Pin module version to ~> v2.0. Submit pull-requests to master branch.

Terraform 0.11. Pin module version to ~> v1.0. Submit pull-requests to terraform011 branch.

Usage with Route53 DNS validation (recommended)

module "acm" {
  source  = "terraform-aws-modules/acm/aws"
  version = "~> v2.0"

  domain_name  = "my-domain.com"
  zone_id      = "Z2ES7B9AZ6SHAE"

  subject_alternative_names = [
    "*.my-domain.com",
    "app.sub.my-domain.com",
  ]

  tags = {
    Name = "my-domain.com"
  }
}

Examples

Conditional creation and validation

Sometimes you need to have a way to create ACM certificate conditionally but Terraform does not allow to use count inside module block, so the solution is to specify argument create_certificate.

module "acm" {
  source = "terraform-aws-modules/acm/aws"

  create_certificate = false
  # ... omitted
}

Similarly, to disable DNS validation of ACM certificate:

module "acm" {
  source = "terraform-aws-modules/acm/aws"

  validate_certificate = false
  # ... omitted
}

Notes

  • For use in an automated pipeline consider setting the wait_for_validation = false to avoid waiting for validation to complete or error after a 45 minute timeout.
  • domain_name can not be wildcard, but subject_alternative_names can include wildcards.

Inputs

Name Description Type Default Required
create_certificate Whether to create ACM certificate bool "true" no
domain_name A domain name for which the certificate should be issued string "" no
subject_alternative_names A list of domains that should be SANs in the issued certificate list(string) [] no
tags A mapping of tags to assign to the resource map(string) {} no
validate_certificate Whether to validate certificate by creating Route53 record bool "true" no
validation_allow_overwrite_records Whether to allow overwrite of Route53 records bool "true" no
validation_method Which method to use for validation. DNS or EMAIL are valid, NONE can be used for certificates that were imported into ACM and then into Terraform. string "DNS" no
wait_for_validation Whether to wait for the validation to complete bool "true" no
zone_id The ID of the hosted zone to contain this record. string "" no

Outputs

Name Description
distinct_domain_names List of distinct domains names used for the validation.
this_acm_certificate_arn The ARN of the certificate
this_acm_certificate_domain_validation_options A list of attributes to feed into other resources to complete certificate validation. Can have more than one element, e.g. if SANs are defined. Only set if DNS-validation was used.
this_acm_certificate_validation_emails A list of addresses that received a validation E-Mail. Only set if EMAIL-validation was used.
validation_domains List of distinct domain validation options. This is useful if subject alternative names contain wildcards.
validation_route53_record_fqdns List of FQDNs built using the zone domain and name.

Authors

Module managed by Anton Babenko.

License

Apache 2 Licensed. See LICENSE for full details.